CVE catalog
CVE-2026-34772
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that allow downloads and progr
- Severity
- Medium · CVSS 5.8
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.21% · Oct 25, 2026
A flaw was found in Electron, a framework used for developing cross-platform desktop applications. This vulnerability, known as a use-after-free, affects applications that manage downloads and actively terminate user sessions. It occurs when a user dismisses a file save dialog while the application is simultaneously closing the associated session, causing the application to access memory that has already been released. This can lead to an application crash or, in more severe cases, memory corruption. Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected. Electron: Electron: Use-after-free vulnerability leads to memory corruption or crash The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | electron | Not reported | 38.8.6 | fixed |
| Cpe | electron | Not reported | 39.8.0 | fixed |
| Cpe | electron | Not reported | 40.7.0 | fixed |
| Cpe | electron | Not reported | Not reported | unknown |
| Npm | electron | Not reported | 38.8.6 | fixed |
| Npm | electron | Not reported | 39.8.0 | fixed |
| Npm | electron | Not reported | 40.7.0 | fixed |
| Npm | electron | Not reported | 41.0.0-beta.7 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | electron | cpe | Not reported | 38.8.6 | Not reported | Not reported | Not reported |
| Cpe | electron | cpe | Not reported | 39.8.0 | Not reported | Not reported | Not reported |
| Cpe | electron | cpe | Not reported | 40.7.0 | Not reported | Not reported | Not reported |
| Npm | electron | npm | Not reported | 38.8.6 | Not reported | Not reported | Not reported |
| Npm | electron | npm | Not reported | 39.8.0 | Not reported | Not reported | Not reported |
| Npm | electron | npm | Not reported | 40.7.0 | Not reported | Not reported | Not reported |
| Npm | electron | npm | Not reported | 41.0.0-beta.7 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-34772]
- [https://osv.dev/vulnerability/GHSA-9w97-2464-8783]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34772.json]
[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]